Docs

Web Application Firewall

Load Balancing Listener association

Associate with WAF through Application Load Balancer (ALB)

If your business accesses a BytePlus Application load balancer instance, you can connect to cloud WAF protection through Application load balancer (ALB). You need to first configure the corresponding listening port on the load balancer instance, and then add it to the WAF instance. The WAF instance will perform bypass detection analysis on the traffic passing through the load balancer, cleaning attack traffic to achieve business forwarding and security protection separation.

Access instructions

When the domain name associated with the ALB instance connects to the WAF service, the WAF will automatically enable protection for the ALB instance, monitoring all traffic passing through this instance. \nThe WAF will create two types of protection sites based on the access status of the domain name:

Individually connected domain names: The WAF will create an independent protection site for it and perform protection based on the domain name dimension. If multiple domain names are accessed, multiple sites will be generated. The protection configurations between each domain name are independent of each other.

Unconnected domain names: The WAF will automatically create a protection site named after the ALB ID (for example, alb-3u64ifon9l34858p9oqi****). The site is responsible for monitoring and protecting all other traffic passing through the ALB instance, and this traffic will be processed uniformly according to the policies configured by the protection site.

Requirements

You have already created a Cloud WAF instance. For more details about creating a cloud WAF instance, see Create a WAF instance.

The domain has not been added to the WAF instance yet.

You have connected the protected domain to the ALB and set up HTTP or HTTPS listeners and forwarding rules.

Steps

In the top menu bar, select the region of your instance.

On the left-side navigation pane, select Website settings, and then click Create New Site.

Select the access method as Application Load Balancer (ALB).

Fill in the basic information of the website to access WAF, and submit.

Parameter	Description	Example
Website configuration
Protected domain	Enter the domain name you want to protect. You can enter the domain name directly, or use a '' wildcard at the start to cover all subdomains without listing them individually. tip If you need to configure both wildcard domains and the main domain itself, please configure them separately. For example: if you need to configure .b.a.com and b.a.com, you must connect to each domain separately and configure policies accordingly.	*.volcwaf001.com
Project	Add the protected domain to the projects authorized for the current account. Project management is a resource management method provided by BytePlus, which allows you to group and manage the cloud resources used by different businesses or projects. By default, it follows the projects of other resources, such as CLB instances and ALB instances. warning If you choose to follow the projects of other resources, changes in the resources within the project may impact the business. You can also choose not to follow the projects of other resources and associate it with the project authorized for the current account. The main account can view all projects, and after switching the project at the top of the console to all resources of the account, the project settings can be adjusted.	default (Default Project)
Load balancing and listeners	Select the available listener from the dropdown list. The WAF will match the corresponding listener information for the domain based on the application load balancing forwarding rules you configured, supporting the selection of multiple application load balancing instances. tip If there are no options available, please confirm whether the protection domain you entered has corresponding forwarding rules configured.	testwaf-test** lsn- tip testwaf is the name of the application load balancing instance. test is the name of the listener. lsn-** is the listener ID.
Log configuration
Log collection	Enable or disable the log service for the current domain. Enabled: WAF starts collecting log data generated by the domain. Disabled: WAF does not collect log data generated by the domain. tip To enable the log service, you must first authorize cross-service access for the WAF, granting WAF permissions for log collection and storage.	Keep it enabled
Record all headers	The fields for log collection are divided into required fields and optional fields. In the required log fields, Host, XForwardedFor, Referer, and UserAgent are common header fields. When you access website protection, WAF collects only these common header log fields by default. Record all headers: record all header fields in the traffic. If you disable recording all headers, the logs will only record these common header fields. If you enable recording all headers, WAF will record common header fields and custom header fields. Except for Cookie, other custom header fields are uniformly recorded in Headers. Exception header fields: refer to header fields that are set not to be recorded to prevent excessive log storage when recording all headers is enabled. Statistical header fields: set the header fields that need to be counted, analyzed, and alerted. For detailed explanations of log fields, please refer to Log Field Description.	Disabled
Access capability
Proxy configuration	Check whether the website that needs to be configured was using Advanced DDoS Protection, CDN, or other layer 7 proxies before integrating with WAF. No: There was no proxy configured, WAF takes the IP making requests to WAF (X-Real-Ip) as the client IP. Yes: A proxy has been configured in front of the WAF. This means that the requests the WAF receives are forwarded through other Layer 7 proxy services, not coming directly from the requesting client. Further configuration is needed to determine the client IP method. X-Forwarded-For: Getting client IP from the X-Forwarded-For field: Identify the first public IP address listed in the X-Forwarded-For (XFF) field as the actual IP address of the client. warning This method poses a risk of attackers manipulating the X-Forwarded-For field. Custom header: Identify and utilize the client IP by matching fields in sequence to represent the actual client IP. If the field matching fails to retrieve the client IP, it will be obtained through the X-Forwarded-For field. However, if the X-Forwarded-For field is compromised by fake and illegal IP addresses, then the X-Real-Ip field will be used to determine the client IP. tip You can configure up to five custom header fields per domain in a single instance.	No

Click OK.

After the domain access, you can quickly configure the rate limiting, vulnerability protection, API protection, and Bot management corresponding protection strategies on the return page, or go directly to the protection strategy page to configure custom strategy content. For more details on protection strategy settings, please refer to Protection policy types.

Last updated: 2025.06.30 16:22:21